/*
 * Analyzer.c
 * NtTrace Analyzer
 * @author Gregoire JACOB (gregoire.jacob@orange-ftgroup.com)
 * @date 02/09/2008
 * @version 1.0
 * Central module, entry point of the analyzer
 */

#include ".\Includes\Analyzer.h"
#include <time.h>

/**
 * main()
 * Open the script and launch a syntactic analysis
 */
int __cdecl main( int argc, char ** argv ){
	int i, shortn, res, size;
	char shortname[NAME_MAX_LENGTH ]; char * extension;
	char dbname[NAME_MAX_LENGTH ];
	char line[LINE_LENGTH];
	clock_t t1, t2; float t;
	//Structures Initialization
	FILE * pf_Trace = NULL;
	FILE * pf_Logf = NULL;
	FILE * pf_Odbf = NULL;
	struct TYPING * types;

	//Parameters checking
	if(argc != 4){
		printf("[-] Incorrect parameters, correct usage is:\n");
		printf("      NtTraceAnalyzer -t/b [Trace file] [Log file]\n");
		printf("      -t/b text or binary output (binary is required for detection\n");
	}else{
		//Performance
		t1 = clock();
		//Retrieving executable name
		strcpy(shortname,argv[2]);
		size = strlen(shortname);
		for(i=0,shortn=0;i<size;i++){
			if(shortname[i]=='\\') shortn=i+1;
		}
		strcpy(procname,&shortname[shortn]);
		extension = strcasestr(procname,"txt");
		if(extension == NULL){
			printf("[-] Wrong extension, text log expected\n");
			exit(0);
		}//if
		strcpy(extension,"exe"); 
		strcpy(fullprocname,"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\NtTrace\\");
		strcat(fullprocname,procname);
		//Opening the trace file
		pf_Trace = fopen(argv[2],"rb");
		if(pf_Trace == NULL){
			printf("[-] Trace file can not be opened\n");
			exit(0);
		}//if
		//Creating the log file
		if(textual){ pf_Logf = fopen(argv[3],"w");
		}else{ pf_Logf = fopen(argv[3],"wb"); }
		if(pf_Logf == NULL){
			printf("[-] Log file can not be created\n");
			exit(0);
		}//if
		if(argv[1][1]=='t'){
			printf("[+] Running in textual mode\n");
			textual = 1; //Textual mode
		}else{
			printf("[+] Running in binary mode\n");
			textual = 0; //Binary mode
		}

		
		types = (struct TYPING *) calloc(1,sizeof(struct TYPING));
		//Beginning analysis line by line
		printf("[+] Beginning analysis of the process trace %s\n",procname);
		res = fscanf(pf_Trace,"Process %d starting at %08X",&procid,&procaddress);
		if(res != 2){
			printf("[-] Trace file in unsupported format (support NtTrace)\n");
			exit(0);
		}//if
		while(!feof(pf_Trace)){
			fgets(line,LINE_LENGTH,pf_Trace);
			processLine(pf_Logf,types,line);
		}
		//Flush log entries
		formatLogEntries(pf_Logf,types,0,0,0);
		fclose(pf_Trace);
		//Performance
		t2 = clock();
		t = t2-t1;
		t = t/CLOCKS_PER_SEC;
		if(textual){
			printfTyping(pf_Logf,types);
			fprintf(pf_Logf,"\n\n[+] Execution time: %f sec\n",t);
		}else{
			int lgth = strlen(argv[3]);
			strcpy(dbname,argv[3]);
			for(i=lgth-4;i<lgth;i++){
				if(dbname[i]=='.'){dbname[i]=0; break;}
			}
			strcat(dbname,".odb");
			pf_Odbf = fopen(dbname,"wb");
			if(pf_Odbf == NULL){
				printf("[-] Object database file can not be opened\n");
			}else{
				printf("[+] Storing object database in %s\n",dbname);
				storeTyping(pf_Odbf,types);
				fclose(pf_Odbf);
			}
		}//if

    }//if

	return 0;
}
